@basictech/react 0.8.0-beta.2 → 0.8.0-beta.3

package/changelog.md

@@ -1,5 +1,11 @@
 # 1.3.4
 
+## 0.8.0-beta.3
+
+### Patch Changes
+
+- Fix PWA/mobile logout issues: harden auth for offline resilience, prevent spurious logouts on transient server errors, proactive token refresh on app resume, and fix potential deadlock in token refresh flow
+
 ## 0.8.0-beta.2
 
 ### Minor Changes

package/dist/index.js

@@ -159,14 +159,37 @@ var init_syncProtocol = __esm({
               onError("Authentication failed: " + (err.message || err), RECONNECT_DELAY);
             }
           };
+          function handleVisibilityResume() {
+            if (document.visibilityState === "visible" && ws.readyState === WebSocket.OPEN) {
+              log("Page became visible - refreshing token for WebSocket");
+              resolveGetToken()({ forceRefresh: true }).then(function(newToken) {
+                if (ws.readyState === WebSocket.OPEN) {
+                  ws.send(JSON.stringify({ type: "tokenUpdate", authToken: newToken }));
+                  scheduleTokenRefresh(newToken);
+                }
+              }).catch(function(err) {
+                log("Token refresh on visibility resume failed:", err);
+              });
+            }
+          }
+          if (typeof document !== "undefined") {
+            document.addEventListener("visibilitychange", handleVisibilityResume);
+          }
+          function cleanupVisibilityListener() {
+            if (typeof document !== "undefined") {
+              document.removeEventListener("visibilitychange", handleVisibilityResume);
+            }
+          }
           ws.onerror = function(event) {
             clearRefreshTimer();
+            cleanupVisibilityListener();
             ws.close();
             log("ws.onerror", event);
             onError(event?.message, RECONNECT_DELAY);
           };
           ws.onclose = function(event) {
             clearRefreshTimer();
+            cleanupVisibilityListener();
             onError("Socket closed: " + event.reason, RECONNECT_DELAY);
           };
           var isFirstRound = true;
@@ -203,6 +226,7 @@ var init_syncProtocol = __esm({
                     },
                     disconnect: function() {
                       clearRefreshTimer();
+                      cleanupVisibilityListener();
                       ws.close();
                     }
                   });
@@ -242,7 +266,7 @@ var init_syncProtocol = __esm({
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.8.0-beta.2";
+    version = "0.8.0-beta.3";
   }
 });
 
@@ -326,7 +350,7 @@ function cleanOAuthParamsFromUrl() {
     const url = new URL(window.location.href);
     url.searchParams.delete("code");
     url.searchParams.delete("state");
-    window.history.pushState({}, document.title, url.pathname + url.search);
+    window.history.replaceState({}, document.title, url.pathname + url.search);
     log("Cleaned OAuth parameters from URL");
   }
 }
@@ -1800,8 +1824,11 @@ var AuthManager = class {
         const refreshToken = await this.storage.get(STORAGE_KEYS.REFRESH_TOKEN);
         if (refreshToken) {
           log("Found refresh token in storage, attempting to refresh access token");
-          this.exchangeToken(refreshToken, true).catch((error) => {
+          this.exchangeToken(refreshToken, true).catch(async (error) => {
             log("Error fetching refresh token:", error);
+            if (this.isNetworkError(error)) {
+              await this.restoreCachedUser();
+            }
           });
         } else {
           const cachedUserInfo = await this.storage.get(STORAGE_KEYS.USER_INFO);
@@ -1870,7 +1897,8 @@ var AuthManager = class {
         log("Token refresh already in progress, waiting...");
         try {
           const newToken = await this.refreshPromise;
-          return newToken?.access_token || "";
+          if (!newToken?.access_token) throw new Error("Token refresh returned empty access token");
+          return newToken.access_token;
         } catch (error) {
           log("In-flight refresh failed:", error);
           if (this.isNetworkError(error)) {
@@ -1884,7 +1912,8 @@ var AuthManager = class {
       if (refreshToken) {
         try {
           const newToken = await this.exchangeToken(refreshToken, true);
-          return newToken?.access_token || "";
+          if (!newToken?.access_token) throw new Error("Token refresh returned empty access token");
+          return newToken.access_token;
         } catch (error) {
           log("Failed to refresh expired token:", error);
           if (this.isNetworkError(error)) {
@@ -1897,7 +1926,8 @@ var AuthManager = class {
         throw new Error("no refresh token available");
       }
     }
-    return this.token.access_token || "";
+    if (!this.token.access_token) throw new Error("Token exists but access_token is empty");
+    return this.token.access_token;
   }
   async getSignInUrl(redirectUri, endpoints) {
     log("getting sign in link...");
@@ -1906,7 +1936,7 @@ var AuthManager = class {
     }
     const pdsEndpoints = endpoints || this.defaultPdsEndpoints();
     await this.storage.set(STORAGE_KEYS.PDS_ENDPOINTS, JSON.stringify(pdsEndpoints));
-    const randomState = Math.random().toString(36).substring(6);
+    const randomState = base64UrlEncode(crypto.getRandomValues(new Uint8Array(16)));
     await this.storage.set(STORAGE_KEYS.AUTH_STATE, randomState);
     const redirectUrl = redirectUri || window.location.href;
     if (!redirectUrl || !redirectUrl.startsWith("http://") && !redirectUrl.startsWith("https://")) {
@@ -2025,7 +2055,10 @@ var AuthManager = class {
     return requested.filter((s) => !granted.has(s));
   }
   /**
-   * Register online/offline handlers that retry pending refreshes.
+   * Register online/offline and visibility handlers that retry pending
+   * refreshes and proactively refresh tokens when the app resumes from
+   * background (critical for PWAs and mobile browsers where timers are
+   * frozen while backgrounded).
    * Returns a cleanup function for useEffect teardown.
    */
   setupNetworkListeners() {
@@ -2047,11 +2080,25 @@ var AuthManager = class {
       log("Network went offline");
       this.isOnline = false;
     };
+    const handleVisibilityChange = () => {
+      if (document.visibilityState === "visible" && this.isSignedIn) {
+        log("App became visible - checking token freshness");
+        this.getToken().catch((err) => {
+          log("Token refresh on visibility resume failed:", err);
+        });
+      }
+    };
     window.addEventListener("online", handleOnline);
     window.addEventListener("offline", handleOffline);
+    if (typeof document !== "undefined") {
+      document.addEventListener("visibilitychange", handleVisibilityChange);
+    }
     return () => {
       window.removeEventListener("online", handleOnline);
       window.removeEventListener("offline", handleOffline);
+      if (typeof document !== "undefined") {
+        document.removeEventListener("visibilitychange", handleVisibilityChange);
+      }
     };
   }
   // ------------------------------------------------------------------
@@ -2114,39 +2161,26 @@ var AuthManager = class {
       const decoded = (0, import_jwt_decode.jwtDecode)(this.token.access_token);
       if (decoded.sub) this.did = decoded.sub;
       if (decoded.scope) this.tokenScope = decoded.scope;
-      const expirationBuffer = 5;
-      const isExpired = decoded.exp && decoded.exp < Date.now() / 1e3 + expirationBuffer;
-      if (isExpired) {
-        log("token is expired - refreshing ...");
-        const refreshToken = this.token.refresh_token;
-        if (!refreshToken) {
-          log("Error: No refresh token available for expired token");
-          this.isAuthReady = true;
-          this.notify();
-          return;
-        }
-        try {
-          const newToken = await this.exchangeToken(refreshToken, true);
-          await this.fetchUser(newToken?.access_token || "");
-        } catch (error) {
-          log("Failed to refresh token in processNewToken:", error);
-          if (this.isNetworkError(error)) {
-            log("Network issue - continuing with expired token until online");
-            await this.fetchUser(this.token.access_token);
-          } else {
-            this.isAuthReady = true;
-            this.notify();
-          }
-        }
-      } else {
-        await this.fetchUser(this.token.access_token);
-      }
+      await this.fetchUser(this.token.access_token);
     } catch (error) {
       log("Error processing token:", error);
       this.isAuthReady = true;
       this.notify();
     }
   }
+  async restoreCachedUser() {
+    const cached = await this.storage.get(STORAGE_KEYS.USER_INFO);
+    if (cached) {
+      try {
+        this.user = JSON.parse(cached);
+        this.isSignedIn = true;
+        log("Restored cached user info for offline mode");
+      } catch {
+      }
+    }
+    this.isAuthReady = true;
+    this.notify();
+  }
   async fetchUser(accessToken) {
     log("fetching user");
     try {
@@ -2180,8 +2214,12 @@ var AuthManager = class {
       this.notify();
     } catch (error) {
       log("Failed to fetch user info:", error);
-      this.isAuthReady = true;
-      this.notify();
+      if (this.isNetworkError(error)) {
+        await this.restoreCachedUser();
+      } else {
+        this.isAuthReady = true;
+        this.notify();
+      }
     }
   }
   /**
@@ -2277,9 +2315,12 @@ var AuthManager = class {
             this.pendingRefresh = true;
             throw new Error("Network issue - refresh will be retried when online");
           }
-          await this.clearStoredAuth();
-          this.resetAuthState();
-          this.notify();
+          const definitiveErrors = ["invalid_grant", "invalid_client", "unauthorized_client"];
+          if (typeof token.error === "string" && definitiveErrors.includes(token.error)) {
+            await this.clearStoredAuth();
+            this.resetAuthState();
+            this.notify();
+          }
           throw new Error(`Token refresh failed: ${token.error}`);
         } else {
           this.token = token;
@@ -2300,7 +2341,9 @@ var AuthManager = class {
         return token;
       } catch (error) {
         log("Token refresh error:", error);
-        if (!this.isNetworkError(error)) {
+        const msg = error instanceof Error ? error.message : "";
+        const alreadyHandled = msg.startsWith("Token refresh failed:");
+        if (!alreadyHandled && !this.isNetworkError(error)) {
           await this.clearStoredAuth();
           this.resetAuthState();
           this.notify();
@@ -2344,6 +2387,7 @@ var AuthManager = class {
     await this.storage.remove(STORAGE_KEYS.PDS_ENDPOINTS);
   }
   isNetworkError(error) {
+    if (error instanceof TypeError) return true;
     if (error instanceof Error) {
       return error.message.includes("offline") || error.message.includes("Network");
     }
@@ -2753,6 +2797,10 @@ function BasicProvider({
           debug,
           onAuthError: (error2) => {
             log("RemoteDB auth error:", error2);
+            if (error2.errorType === "forbidden") {
+              log("403 Forbidden - user lacks required scope, not signing out");
+              return;
+            }
             handleSignOut();
           }
         });